From 42d9e2d5c1319785e8812c474c135888ed2fcc40 Mon Sep 17 00:00:00 2001 From: korya <148461+korya@users.noreply.github.com> Date: Sun, 30 Aug 2026 13:28:01 -0400 Subject: [PATCH] chore(ci): Add Dependabot config for GitHub Actions Keeps the action majors pinned across the ci, live, and release workflows current instead of drifting until a runner deprecation breaks them. All bumps are grouped into one weekly PR, so a week that ships checkout, setup-go, and golangci-lint-action costs a single review and a single CI run rather than three. The commit prefix is set to `ci` to match the repo's Conventional Commits format. The `gomod` ecosystem is deliberately omitted. AGENTS.md mandates standard library only, so go.mod carries zero requires and there is no go.sum; Dependabot's Go updater would have nothing to bump, as it does not touch the `go` directive. Whether to auto-bump requires at all is a decision better made alongside the first real dependency: this module is imported as a library, and under minimal version selection a require is a floor, so raising it raises the floor for every consumer. Dependabot security updates are not configured here. They are a repository setting, run off the dependency graph, and need no entry in this file; they have been enabled separately and will cover a future dependency without further changes. Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_017dM7M83LicKy8psVSvjod2 --- .github/dependabot.yml | 14 ++++++++++++++ 1 file changed, 14 insertions(+) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..86c86c7 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,14 @@ +version: 2 +updates: + - package-ecosystem: github-actions + directory: / + schedule: + interval: weekly + day: monday + # One PR for all action bumps instead of one per action. + groups: + actions: + patterns: + - "*" + commit-message: + prefix: ci